ID. Date of interview 
date 44/42/19 


ID. Time interview started 
Start 09:09:42 


ID.end Completion date of interview 
Date 44/12/19 


ID.end Time interview ended 
09:16:19 


ID. Duration of interview 
time 6.62 


Start of new case 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
O) Yes 

© No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


A lot of organisations use email to process personal data in a variety of ways; this can present a burden 
to an organisation where retention hasn't been well managed. | think a stronger statement around refusal 
where personal data is intrinsically linked to that of a 3rd party would be welcomed, as would some 
guidance on how to judge if a SAR is manifestly unfounded or excessive. 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
©) Yes 
© No 

©) Unsure / don't know 


If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


There could be more examples covering other sectors 


Q4 We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


Repeating requests, chained requests and unfocused requests which are designed to 
be punitive rather than truly discover what personal data is processed by a data 
controller. The biggest cost in returning SARs is dealing with email; this can span 
years and involve a huge amount of personal data relating to 3rd parties, yet the 
expectation seems to be that this should be made available with redactions of 3rd 


party data. Several SARs my team has dealt with in the last 12 months have taken 
over 1000 person hours to complete. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-—Slightly Moderately 4-Very 5- Extremely 
useful useful useful useful useful 


© 


Q6 Why have you given this score? 


I feel it needs stronger guidance, more definite statements and further examples. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 Please provide any further comments or suggestions you may have about the draft 
guidance. 


Q9 Are you answering as: 
O An individual acting in a private capacity (eg someone providing their views as a member of the public) 
©) An individual acting in a professional capacity 
(C) On behalf of an organisation 
(C) Other 
Please specify the name of your organisation: 


What sector are you from: 
higher education 


Q10 How did you find out about this survey? 
( `) ICO Twitter account 
(_) ICO Facebook account 
©) ICO LinkedIn account 
©) ICO website 
( ) ICO newsletter 
(_) ICO staff member 
( ) Colleague 
(_) Personal/work Twitter account 
\_) Personal/work Facebook account 
©) Personal/work LinkedIn account 
C) Other 
If other please specify: 


